PT-2026-42755 · Apache · Apache Cxf

Colm O Heigeartaigh · Published 2026-05-22 · Updated 2026-06-30 · CVE-2026-44930

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11

Description An LDAP injection issue exists in the LDAP Certificate repository of the XKMS server. This allows an attacker to retrieve arbitrary certificates from the repository. LDAP injection is a technique where malicious LDAP statements are used to manipulate queries sent to a directory server.

Recommendations Upgrade to version 4.2.1. Upgrade to version 4.1.6. Upgrade to version 3.6.11.

Exploit

Fix

Weakness Enumeration

CWE-90

Related Identifiers

BDU:2026-07399

CVE-2026-44930

GHSA-PG32-686Q-QH6X

Affected Products

Apache Cxf

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44930.json · Exploit
• https://osv.dev/vulnerability/GHSA-pg32-686q-qh6x · Vendor Advisory
• https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44930 · Security Note
• https://bdu.fstec.ru/vul/2026-07399 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44930 · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://access.redhat.com/security/cve/CVE-2026-44930 · Note
• https://t.me/CVEtracker/54627 · Telegram Post
• https://twitter.com/SecAlertsCo/status/2060203940843532646 · Twitter Post
• https://twitter.com/f1tym1/status/2059241812263350324 · Twitter Post
• https://repo.maven.apache.org/maven2 · Note
• https://openwall.com/lists/oss-security/2026/05/22/9 · Note
• https://twitter.com/oss_security/status/2058061804115255675 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/22/9 · Note